PHP - SITE - Advanced Web Factories

YouPHPTube 7.7 SQL Injection

PHP Files ≈ Packet Storm Dec 5, 2019 | 00:34 am

YouPHPTube versions 7.7 and below suffer from a remote SQL injection vulnerability in getChat.json.php.

WordPress Plainview Activity Monitor 20161228 Remote Command Execution

PHP Files ≈ Packet Storm Nov 29, 2019 | 17:50 pm

WordPress Plainview Activity Monitor plugin is vulnerable to OS command injection which allows an attacker to remotely execute commands on the underlying system. Application passes unsafe user supplied data to ip parameter into activities_overview.php. Privileges are required in order to[…]

Debian Security Advisory 4576-1

PHP Files ≈ Packet Storm Nov 26, 2019 | 18:21 pm

Debian Linux Security Advisory 4576-1 - An out-of-bounds write vulnerability was discovered in php-imagick, a PHP extension to create and modify images using the ImageMagick API, which could result in denial of service, or potentially the execution of arbitrary code.

Remote File Inclusion / Local File Inclusion Attack And Defense Techniques

PHP Files ≈ Packet Storm Nov 24, 2019 | 21:48 pm

Whitepaper called Remote File Inclusion / Local File Inclusion Attack and Defense Techniques. This paper focuses on PHP-based attacks.

Debian Security Advisory 4573-1

PHP Files ≈ Packet Storm Nov 19, 2019 | 16:26 pm

Debian Linux Security Advisory 4573-1 - Multiple vulnerabilities have been found in the Symfony PHP framework which could lead to a timing attack/information leak, argument injection and code execution via unserialization.

FusionPBX Operator Panel exec.php Command Execution

PHP Files ≈ Packet Storm Nov 14, 2019 | 17:09 pm

This Metasploit module exploits an authenticated command injection vulnerability in FusionPBX versions 4.4.3 and prior. The exec.php file within the Operator Panel permits users with operator_panel_view permissions, or administrator permissions, to execute arbitrary commands as the web server user by[…]

FusionPBX Command exec.php Command Execution

PHP Files ≈ Packet Storm Nov 14, 2019 | 17:08 pm

This Metasploit module uses administrative functionality available in FusionPBX to gain a shell. The Command section of the application permits users with exec_view permissions, or superadmin permissions, to execute arbitrary system commands, or arbitrary PHP code, as the web server[…]

CMS Made Simple 2.2.8 Remote Code Execution

PHP Files ≈ Packet Storm Nov 13, 2019 | 18:28 pm

An issue was discovered in CMS Made Simple version 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible to reach an unserialize call with a crafted value in[…]

Linear eMerge E3 1.00-06 card_scan_decoder.php Command Injection

PHP Files ≈ Packet Storm Nov 12, 2019 | 18:13 pm

Linear eMerge E3 versions 1.00-06 and below unauthenticated command injection remote root exploit that leverages card_scan_decoder.php.

Linear eMerge E3 1.00-06 card_scan.php Command Injection

PHP Files ≈ Packet Storm Nov 12, 2019 | 18:11 pm

Linear eMerge E3 versions 1.00-06 and below unauthenticated command injection remote root exploit that leverages card_scan.php.

rConfig 3.9.2 Command Injection

PHP Files ≈ Packet Storm Nov 7, 2019 | 15:58 pm

This Metasploit module exploits an unauthenticated command injection vulnerability in rConfig versions 3.9.2 and prior. The install directory is not automatically removed after installation, allowing unauthenticated users to execute arbitrary commands via the ajaxServerSettingsChk.php file as the web server user.[…]

Red Hat Security Advisory 2019-3735-01

PHP Files ≈ Packet Storm Nov 6, 2019 | 17:00 pm

Red Hat Security Advisory 2019-3735-01 - PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. An underflow issue has been addressed.

Red Hat Security Advisory 2019-3724-01

PHP Files ≈ Packet Storm Nov 6, 2019 | 16:59 pm

Red Hat Security Advisory 2019-3724-01 - PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. An underflow issue has been addressed.

Red Hat Security Advisory 2019-3300-01

PHP Files ≈ Packet Storm Nov 1, 2019 | 18:12 pm

Red Hat Security Advisory 2019-3300-01 - PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. An underflow issue was addressed.

Red Hat Security Advisory 2019-3299-01

PHP Files ≈ Packet Storm Nov 1, 2019 | 18:11 pm

Red Hat Security Advisory 2019-3299-01 - PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Issues addressed include buffer overflow and information leakage vulnerabilities.

Red Hat Security Advisory 2019-3287-01

PHP Files ≈ Packet Storm Nov 1, 2019 | 18:00 pm

Red Hat Security Advisory 2019-3287-01 - PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. An underflow issue was addressed.

Mr Blog PHP Cross Site Scripting / SQL Injection

PHP Files ≈ Packet Storm Nov 1, 2019 | 12:11 pm

Mr Blog PHP suffers from cross site scripting and remote SQL injection vulnerabilities.

Ubuntu Security Notice USN-4166-2

PHP Files ≈ Packet Storm Oct 29, 2019 | 15:56 pm

Ubuntu Security Notice 4166-2 - USN-4166-1 fixed a vulnerability in PHP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. It was discovered that PHP incorrectly handled certain paths when being used in FastCGI configurations.[…]

Ubuntu Security Notice USN-4166-1

PHP Files ≈ Packet Storm Oct 28, 2019 | 21:35 pm

Ubuntu Security Notice 4166-1 - It was discovered that PHP incorrectly handled certain paths when being used in FastCGI configurations. A remote attacker could possibly use this issue to execute arbitrary code.

Gentoo Linux Security Advisory 201910-01

PHP Files ≈ Packet Storm Oct 28, 2019 | 21:24 pm

Gentoo Linux Security Advisory 201910-1 - A vulnerability in PHP might allow an attacker to execute arbitrary code. Versions less than 7.1.33 are affected.